c# zxing qr code generator Lesson 3 in Visual C#.NET

Generation QR Code ISO/IEC18004 in Visual C#.NET Lesson 3

10-27

IP properties You can require that the access server supply an IP address, the access client request an IP address, the access server determine an IP address assignment, or that a static IP address is assigned. You can also define IP packet filters that restrict or block traffic (incoming or outgoing) based on the IP address. Multilink properties You can set multilink properties that enable multilink and determine the maximum number of ports a multilink connection can use. Authentication properties You can enable the various authentication types that are allowed for a connection, such as MS-CHAP, EAP, and so on, and can specify whether users can change their expired passwords using MS-CHAP and MS-CHAP v2. Encryption properties You can set encryption properties to various encryp tion strengths such as No encryption, Basic encryption, Strong encryption, and Strongest encryption, which supports triple DES (160-bit encryption). Advanced properties You can set advanced properties to specify which RADIUS attributes are sent back by the IAS server to the RADIUS client.

Remote policies can also be used to specify additional restrictions. After the connection is authorized, remote access policies can restrict connections based on:

In organizations in which more than one network access server is required, centraliza tion of accounting and authentication of connections may be the preferred method of doing business. For example, instead of each NAS being responsible for keeping track of how long users connect to various devices or authenticating the users as they con nect to various remote systems, each NAS can redirect these tasks to a centralized server that is running the Internet Authentication Service (IAS). Before you can understand what IAS is, you must first understand the technology on which it is based, Remote Authentication Dial-In User Service (RADIUS). This is a widely used protocol that enables centralized accounting, authentication, and authori zation for remote network access. With RADIUS, you can manage network access for VPN, dial-up, and wireless networks.

10-28

10

There are several components needed to implement RADIUS:

RADIUS server This server authenticates, authorizes, and performs accounting functions when a connection attempt is made from a remote access client. The remote access client can be any of the clients you learned about earlier: dial-in, VPN, and wireless. For example, if a connection request is made, the server com pares the attributes of the connection request with a set of rules and any information it has in the user account database. The attributes can be such things as day and time, IP number of the RADIUS client, and so forth. Based on this information, the RADIUS server either accepts or rejects the connection. RADIUS client A RADIUS client can be a dial-up server, VPN server, or a wireless access point (AP). When a remote access client attempts a connection to any of these servers, the RADIUS client receives the request and forwards it to the RADIUS server. For example, if a connection to a dial-up server were made, the dial-up server (RADIUS client) would not handle the authentication or authoriza tion of the connection, but would send it to the RADIUS server. RADIUS proxy In very large organizations or when an ISP is outsourced to perform dial-up access for a company, there may be multiple RADIUS servers available to authenticate, authorize, and perform accounting functions. A RADIUS proxy determines which RADIUS server to forward the request to. For example, the RADIUS client would receive a connection request from a remote access client, forward the request to the RADIUS proxy, and the RADIUS proxy would then forward the request to the appropriate RADIUS server. See Figure 10-4.

IAS performs the following for dial-up, VPN, and wireless connections: